[FD] Postecert FIRMAOK! - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-9661)

["Intilangelo, Andrea" <andrea@xxxxxxxxxxxxxx>]

Postecert FIRMAOK! - Local Privilege Escalation Vulnerability via OpenSSL 
Configuration (CVE-2026-9661)

- Software Link:

https://postecert.poste.it/firma/download.shtml

- Affected Versions:

Version 1.6.29 (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC)
Other versions may be affected as well.

- Vulnerability Description:


The application relies on OpenSSL configuration paths influenced by the 
OPENSSLDIR environment variable. If this variable is improperly handled or 
trusted without validation, a low-privileged user can manipulate it to load 
malicious configuration files or libraries. 
Because the software is often used in shared or multi-user environments, this 
can lead to privilege escalation.

- Proof of Concept:


The PoC in the original advisory demonstrates that a low-privileged local user 
can create a directory that does not otherwise exist and cause the main 
application binary, "launcher.exe" (which launches multiple dependent 
executables, such as updater.exe and tslupdater.exe, which in turn load several 
additional libraries), to access attacker-controlled OpenSSL-related files from 
that location.

- Impact:


Since any user can execute it, the app runs with the same privileges as the 
user who launches it, any file it loads from that location will also be trusted 
at that privilege level. This can be abused and leading to unauthorized 
privilege gain as horizontal privilege escalation and possibly vertical 
privilege escalation.

- Disclosure Timeline:

[18/04/2026] - Vulnerability discovered
[23/04/2026] - CNA and vendor contacted
[26/05/2026] - Vulnerability details provided - deadline set at 120 days, in 
accordance with the CNA disclosure policy
[ meantime ] - Multiple follow-up attempts by the CNA to the vendor; no response
[28/09/2026] - Deadline reached, agreed with the CNA on an additional one-month 
extension
[28/10/2026] - Revised deadline reached
[06/11/2026] - Began the Public disclosure phase

- CVE Reference:

CVE-2026-9661 has been assigned to this vulnerability.

- Credits:

Vulnerability discovered by Andrea Intilangelo

- Original Advisory:


https://olografix.org/acme/_poc/CVE-2026-9661.pdf

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/